SAR deadline calculator

Enter the date a subject access request arrived to see when your response is due, and the latest date if the request is complex. Worked out using the ICO’s rules for short months, weekends and bank holidays.

When did you receive the request?

Use the date it arrived, even if that was a weekend, a bank holiday or the school holidays. If you asked for ID, use the date you received it.

Date received

Enter a date to see the deadlines.

How the deadline is worked out

UK GDPR gives you one calendar month to respond to a subject access request. The ICO explains how to count it:

Start from the date the request arrives, whether or not it is a working day.
Count forward to the same date in the next month.
If that month has no such date, use its last day (31 January becomes 28 or 29 February).
If the result is a weekend or bank holiday, the deadline is the next working day.
For a complex request, count three months from the original date instead, with the same weekend and bank holiday rule.

When the clock stops

If you genuinely need ID to confirm who the requester is, or evidence that someone is authorised to act for them, the month runs from the day you receive it. Ask as soon as possible, and only for what you need.

If you ask for clarification about what information they want, the clock stops on the day you ask and restarts the day after they reply. Add the days it was stopped to the deadline above. Keep a record of both.

Nothing else stops it. School holidays, staff absence and the size of the mailbox do not.

SAR deadline questions

How long do you have to respond to a subject access request?

Without undue delay and at the latest within one calendar month of receiving it. The month starts on the day the request arrives, even if that is not a working day, and ends on the same date in the following month.

What if there is no matching date in the next month?

Use the last day of that month. A request received on 31 January is due by 28 February, or 29 February in a leap year.

What if the deadline falls on a weekend or bank holiday?

The deadline moves to the end of the next working day. This calculator uses the England and Wales bank holidays published on GOV.UK.

When can you extend a SAR to three months?

You can extend by up to two further months if the request is complex, or if you have received a number of requests from the same person. The extended deadline is three months from the original start date. You must tell the requester within the first month, and explain why. Having a lot of information to retrieve or redact does not, by itself, make a request complex.

Do school holidays pause the SAR deadline?

No. GOV.UK guidance for schools says a SAR response cannot be extended because it is the school holidays. A request received in the holidays, or on the last day of term, still has the one-month deadline.

Does the clock stop while you wait for ID or clarification?

If you need to confirm the requester’s identity, the time limit starts when you receive the information you asked for. If you ask for clarification about the information requested, the clock stops on the day you ask and resumes the day after you get an answer, so you can add the days it was stopped to the deadline. You cannot ask someone to narrow their request.

Based on the ICO’s right of access guidance on time limits, the GOV.UK guidance Data protection in schools: dealing with subject access requests and the England and Wales bank holidays on gov.uk/bank-holidays. Scotland and Northern Ireland have some different bank holidays. This is a planning aid, not legal advice.

Now make the deadline

RedactBox searches a whole mailbox export at once and redacts every match in one pass, so the month goes on review rather than on blacking out names.

Start free

Next: how to redact emails for a SAR, SEND SARs in schools and the SAR redaction checklist.